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ABSTRACT 


These  guidelines  were  prepared  to  assist  the  CPSC  in  the  development 
of  generic  safety  standards.    This  development  is  based  on  conceptual 
models  of  product -hazard  interactions  and  analyses  of  accident  sequences, 
product  clustering,  and  hazard  characteristics. 

The  motivation  for  these  guidelines  is  based  on  a  perceived  need 
to  evolve  generic  standards  instead  of  manifold  product-specific  standards; 
to  expedite  the  standard  development  process;  and  to  enhance  the  efficiency 
of  standards  for  consumer  product  safety. 


v 


i 
i 

I 

! 


CHAPTER  1.    FOUNDATIONS  AND  BACKGROUND 

Introduction 

These  guidelines  have  been  prepared  for  the  purpose  of  assisting  in 
the  analysis,  development  and  evaluation  of  generic  safety  standards.  They 
provide  a  systematic  approach  to  the  investigation  of  product -hazard  problems, 
starting  with  the  principal  factors  to  be  analyzed  and  ending  with  a 
discussion  of  likely  changes  in  the  traditional  process  of  standards 
development . 

A  generic  safety  standard  is  associated  with  a  large  number  of 
consumer  product -types.    The  scope  of  a  generic  standard  is  in  direct 
contrast  with  a  product-specific  standard,  which  addresses  the  control 
of  a  single  product  or  product -type.    The  ideal  generic  standard  has  a 
single  test  method  for  all  products  intended  to  be  covered  by  the  standard. 
The  success,  however,  and  also  the  greatest  challenge,  of  a  generic 
standard  lies  in  its  capability  to  address  a  variety  of  product- types 
and  yet  retain  sufficient  clarity  and  specificity  to  be  an  effective 
instrument  of  regulation. 

In  these  guidelines,  the  development  of  a  generic  standard  is  based 
on  a  multi-stage  analysis  which  begins  with  product -accident  data  and 
ends  with  an  identification  of  a  count ermeasure ,  or  countermeasures ,  and 
a  test-method  for  compliance.    Generic  standards  may  also  arise  from 
the  need  to  streamline  and  consolidate  a  number  of  extant  standards 
which  address  a  common  problem;  or  may  evolve  from  a  need  to  synthesize 
portions  of  extant  standards  which  are  similar  or  related  and  would  be 
more  effective  or  efficient  if  restated  under  a  new,  single  generic 
standard. 
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A.  IVhat  Is  A  Generic  Standard? 

The  basic  elements  of  a  standard  address  product  identification,  which 
includes  descriptions,  classifications,  sizes  and  tolerances;  references 
and  definitions;  safety  specifications,  which  include  requirements  as  they 
pertain  to  materials,  design,  construction,  physical  attributes,  and 
environment;  functional  performance;  test  procedures;  quality  control; 
product  limitations;  and  exceptions  to  the  standard. 

A  generic  safety  standard  addresses  all  of  these  elements  and  is 
obligated  to  provide  the  same  degree  of  quality  and  integrity  as  any  other 
standard.    Although  a  generic  safety  standard  covers  a  large  number  of 
products  or  product-types  as  opposed  to  the  product-specific  standard, 
it  must  provide  an  adequate  and  workable  equivalent  of  each  part  of  a 
product -specific  standard.    This  is  true  for  several  reasons: 

(1)  The  countermeasure  must  be  clearly  defined  in  order  that  it  may 
be  applied  to  each  product -type  covered  by  the  standard, 

•    (2)  The  test  method,  or  methods,  must  be  clearly  identified  as  to 
the  product-types  for  which  they  are  applicable, 

(3)  All  criteria  and  special  requirements  must  be  unambiguous, 

(4)  Interpretation  and  application  of  the  standard  must  be  clear 
and  direct,  and     '  ^     ,  ,- 

(5)  The  user  must  feel  secure  that  the  generic  standard  is  as 
effective  as  the  product -specific  standards  it  displaces. 

B.  Principal  Factors  of  Generic  Safety  Standards 

In  order  to  understand  the  nature  of  a  generic  safety  standard  more 
systematically,  we  examine  in  this  section  a  general  overview  of  the 

*A  countermeasure  is  defined  as  a  means,  device,  or  expedient  to  counter, 
modify  or  rectify  a  potential  hazard. 
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process  for  determining  the  generic  situation.    Chapters  II  and  III 
elaborate  :md  ex]olicate  this  process  in  greater  detail.     It  is  our 
intent  here  only  to  explore  the  general  nature  of  the  factors  as  they 
relate  to  the  analysis  of  product -hazard  problems. 

If  an  analysis  of  accident  data  shows  that  a  large  number  of  products 
are  associated  with  a  common  hazard,  and  the  hazard  produces  approximately 
the  same  type  and  severity  of  injury  under  similar  environmental  conditions 
then  a  generic  situation  probably  exists  and  it  is  likely  that  a  counter- 
r.easure  to  the  hazard  can  be  specified.    The  principal  factors  involved 
in  making  an  assessment  of  a  generic  case  are  given  in  Figure  I-l. 
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Figure  I-l  depicts  the  major  factors  that  are  involved  in  deci4ing 
between  a  generic  or  product- specific  standard.    Box  1  addresses  the  number  of 
products  associated  with  an  identified  hazard.     If  this  number  is  relatively 
small  (without  defining  what  "small"  is) ,  it  may  be  desirable  to  treat 
the  problem  on  an  individual  product  basis,  thereby  precluding  a  generic 
approach.    If,  however,  the  number  of  products  or  product - types  is  relatively 
large  (i.e.,  great  enough  to  achieve  an  expected  efficiency  in  preparation  time 
and  scope  of  coverage)  we  proceed  to  Box  2.    Box  2  addresses  the  character 
of  the  injury  associated  with  the  hazard.    If  the  injury  occurs  with  a 
wide  range  of  effects  (Box  3) ,  it  may  be  necessary  to  measure  these 
effects  in  different  ways.    This  may  require,  in  the  worst  case,  as  many 
countermeasures  as  there  are  diverse  effects.    The  consequence  of  this 
is  the  need  to  provide  a  separate  test  method  for  each  required  countermeasure 
(Boxes  4  and  5).    This  logic,  therefore,  leads  to  the  conclusion  that  product- 
specific  regulation  may  be  the  only  satisfactory  way  to  address  this 
product -hazard  problem. 

If,  on  the  other  hand,  the  character  of  the  injury  (Box  2)  is  slight 
in  its  range  of  effects  and  can  be  represented  by  a  single  parameter,  or  by 
a  manageable  set  of  related  parameters  (Box  6) ,  then  the  regulation  of  the 
hazard  by  generic  means  has  greater  likelihood.    The  next  factor  which  bears 
directly  on  our  analysis  is  the  determination  of  how  the  hazard  is  manifested 
in  each  product- type  (Box  7).    If  the  level  of  risk- -defined  as  a  probability 
of  injury --cannot  be  described  independently  of  the  specific  product 
characteristics  (Box  8) ,  we  may  find  that  a  generic  description  of  the 
risk  cannot  be  made  for  the  entire  cluster  of  products.    If  this  occurs,  then 
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we  are  forced  into  the  situation  that  leads  back  to  the  need  for 
separate  test  methods  (Box  5).    If,  however,  the  risk  is  essentially  the 
same  for  all  products  in  the  cluster  (Box  9) ,  the  generic  property  is 
not  lost  and,  in  principle,  a  single  countermeasure  can  be  determined. 
All  that  remains  is  to  determine  the  feasibility  of  a  single,  universal 
test  method  (Box  10).    If  this  is  not  possible,  and  technological  development 
of  a  universal  test  method  is  not  feasible,  then  we  must  rely  on  test 
methods  which  are  product-specific  (Box  11) .  It  is  not  necessarily  true 
that  this  would  preclude  a  generic  approach  to  the  problem,  however.  If 
the  number  of  test  methods  needed  is  equal  to  the  number  of  product - 
types  in  the  cluster,  then  we  are  forced  back  to  the  logic  of  Box  5  if 
the  number  of  types  is  large.    Otherwise,  a  generic  concept  is  still 
feasible,  even  with  multiple  test  methods.  The  ideal  realization  is  to 
obtain  a  universal  test  method  which  would  provide  the  basis  for  a 
succinct  and  comprehensive  generic  standard  (Box  12) . 

In  summary,  we  find  that  the  factors  are:     (1)  that  the  number  of 
products  associated  with  a  hazard  is  large,  (2)  that  the  character  of 
the  injury  shows  a  narrow  range  of  effects  which  are  depictable  by  a 
single  or  few  descriptors,  (3)  that  the  hazard  is  essentially  the  same 
for  all  products  in  the  cluster,  and  (4)  that  a  single  test  method  is 
available  or  can  be  developed.    A  generic  standard  becomes  a  reasonable 
alternative  for  regulating  product -hazard  combinations  satisfying  these 
four  conditions. 

A  consequence  of  this  approach  is  the  requirement  to  collect  and 
evaluate  information  on  all  the  products  which  may  be  covered  by  the 
standard,  and  to  determine  for  each  product-type  the  perceived  hazard. 
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injury  severity,  countermeasure ,  and  the  most  efficient  test  method.  The 
data  are  needed  to  ascertain  the  nature  of  the  product -hazard  relationship; 
and  the  selection  of  product -types  as  candidates  for  regulation  is  based  on 
repeated  and  increasingly  refined  evaluations  of  product -hazard  characteristics. 
C.      Definitions  of  Hazard,  Risk,  Exposure,  Accident  and  Control 
Definitions 

In  order  to  understand  the  concepts  and  analysis  contained  in  these 
guidelines,  and  to  clarify  arguments  and  necessary  conditions  for  the 
development  of  generic  standards,  we  introduce  working  definitions  of 
hazard,  risk,  exposure ,  accident,  and  control.    Our  definitions  are  as 
follows: 

(1)  hazard--a  direct  or  indirect  source  of  injury  or  damage, 

(2)  risk--a  probability  of  injury  or  damage, 

(3)  exposurea  subjection  to  an  action  or  event, 

(4)  accident- -an  event  which  results  in  injury  or  damage, 

(5)  control- -a  restraint  on  or  influence  over  a  hazard  or 
risk. 

As  a  source  of  danger  a  hazard  is  usually  directly  related  to  a 
form  of  energy.    The  form  may  be  mechanical,  electrical,  thermal,  chemical, 
electromagnetic,  radiative,  or  auditory. 

Risk  is  sometimes  equated  to  hazard,  but  we  assume  risk  to  be  related 
to  the  control  of  the  hazard  and  the  use  of  the  product. 

Exposure  is  a  variable  which  has  been  the  subject  of  extensive 
analyses  in  a  variety  of  safety  problems.    Each  analysis  has  tended  to 
define  exposure  in  a  way  that  is  amenable  to  quantification  but  still 
retains  enough  generality  to  cover  a  wide  range  of  interpretations. 
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Tlic  major  difficulty  in  measuring  exposure  lies  in  its  dependence  upon 
unpredictable  causal  factors  and  interactions.     It  is  difficult  to 
define  the  point  at  which  exposure  ends  and  the  process  of  an  accident 
begins . 

An  evaluation  of  accident  causation  is  made  difficult  because  if 
the  evaluation  is  to  be  useful  in  making  decisions  about  product  safety,  it 
should  include  human  factors,  environmental  conditions  and  product  charac- 
teristics in  scenarios  which  reflect  the  likely  combinations  that  may  occur 

The  definition  of  control  includes  not  only  the  substantive  restraint 
of  a  hazard,  but  also  those  controls  which  are  derived  from  the  use  of 
the  product  and  the  perceived  respect  for  the  risk. 

Since  these  five  variables,  to  which  are  attached  specific  definitions 
can  take  a  variety  of  forms,  the  job  of  analysis  is  difficult;  but  if  an 
approximation  to  their  phenomena  is  possible,  and  in  many  cases  it  is, 
conclusions  can  be  drawn  which  provide  the  basis  for  developing  a  generic 
or  product -specific  regulation. 
D.      Process  of  Generic  Standard  Development 

The  development  of  a  voluntary  product-specific  standard  has 
traditionally  included  about  seven  major  factors: 

1.  number  and  expertise  of  participants, 

2.  orientation  to  the  standard  to  be  developed, 

3.  trade-offs  or  negotiations  among  interested  parties, 

4.  study  of  affected  or  related  existing  standards, 

5.  problems  of  liability, 

6.  data  collection, 

7.  consensus  process  for  approval. 


How  are  these  factors  changed  if  our  standard  is  now  generic 
instead  of  product-specific?    First,  the  number  of  participants  will 
be  greater,  and  certainly  each  product- type  should  be  represented, 
as  a  minimum.    Second ,  each  member  of  the  group  developing  the  standard 
must  think  in  terms  of  generic  coverage  rather  than  product -specific 
coverage.    Third,  negotiations  on  countermeasures  and  a  test  method 
may  be  far  more  difficult  for  many  product- types  than  for  a  single  product. 
Fourth,  the  displacement  of  existing  standards  may  be  unprecedented  in  the 
experience  of  the  members;  therefore,  care  must  be  taken  to  ensure  the 
quality  and  integrity  of  the  generic  standard  vis-a-vis  the  standards 
it  replaces.    Fifth,  it  is  unlikely  that  addressing  liability  will  be 
markedly  different  from  present  procedures.    Sixth,  data  collection 
becomes  more  extensive  and  more  difficult  for  purposes  of  decision 
making  within  the  committee  on  product -hazard  inferences,  countermeasures, 
and  test  methods.    And  Seventh ,  the  consensus  process  will  be  affected 
because  of  the  potential  impact  of  the  standard  on  greater  segments  of 
industry.    Qiapter  III,  F,  discusses  these  issues  in  greater  detail,  but 
it  is  critical  that  a  thorough  analysis  of  product-hazard  factors  be 
carried  out  in  order  to  provide  a  clear  portrayal  of  the  hazard  and  its 
countermeasure . 

E.      Organization  of  the  Guidelines 

These  guidelines  are  organized  into  four  functional  areas:    the  structures 
needed  for  the  analysis  and  evaluation  of  product -hazard  problems  (Chapter  II) ; 
the  methodology  needed  to  develop  a  generic  standard  (Chapter  III) ;  a 
summary  of  items  for  consideration  in  an  impact  evaluation  (Chapter  IV) ; 
and  a  summary  of  the  elements  of  fault-tree  analysis  (Appendix). 
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CHAPTER  II.    PRODUCT -HAZARD  ANALYSIS 

Introduction 

Chapter  I  presented  a  general  outline  for  product -hazard  analysis  as 
a  first  step  toward  a  systematic,  empirical  investigation  of  product 
safety. 

In  this  chapter  these  concepts  are  developed  into  an  analytic 
procedure  for  identifying  generic  properties  in  product -hazard  combinations. 
Metliods  for  tabulating  data  and  developing  decision  information  are 
presented  for  each  phase  of  the  procedure. 

The  following  sections  identify  the  principal  factors  in  the  analysis 
of  product -hazard  characteristics,  examine  the  regulatory  form  of  each 
combination  of  the  principal  factors,  examine  the  phases  for  the  determination 
of  properties  of  product-hazard  characteristics  which  are  amenable  to 
generic  control,  and  review  methods  and  data  sources  associated  with 
each  phase  of  the  investigation.    Taken  as  a  whole,  the  contents  of 
these  sections  constitute  a  procedure  for  studying  a  variety  of  problems 
associated  with  hazards,  safety,  controls,  and  data  development. 
A.      Principal  Factors  in  the  Analysis  of  Product-Hazard  Characteristics 

Product -hazard  characteristics  tend  to  be  associated,  primarily, 
with  four  basic  factors  of  accident  phenomena:    injury  types,  injury 
severity,  morbidity  parameters,  and  product  involvement. 

Injury  type  is  described  by  a  general  class  label  such  as  laceration, 
bum,  fracture ,  contusion,  hematoma ,  and  so  on. 

Injury  severity  is  defined  as  the  extent  of  physical  trauma  to  the 
accident  victim,  and,  depending  on  the  injury  type,  may  have  a  wide 
range  of  possible  descriptions. 


II-l 


1 


A  morbidity  parameter  is  a  quantitative  description  of  the  injury 
severity,  where  such  descriptions  are  meaningful  and  practicable  in  a 
medical  or  analytical  context.    Examples  would  be  an  amount  of  certain 
radiation  per  unit  area  of  exposure  or  a  diagnosis  as  a  set  of  specified 
morbidity  parameters. 

Product  involvement  is  essentially  the  way  in  which  a  product 
contributes  to  an  accident  and  any  subsequent  injuries. 

Each  of  these  factors  plays  a  critical  role  in  our  analytic  procedure. 
They  will  be  used  to  develop  qualitative  criteria  for  generic  properties  of 
product -hazard  characteristics.     In  the  material  to  follow  in  Section  C, 
two  modifiers  are  associated  with  each  of  these  factors.    These  modifiers 
are  used  to  identify  the  extent  of  the  factor  in  the  accident  phenomena. 
For  each  of  the  terms  "injury  type"  and  "injury  severity,"  we  specify 
whether  the  factor  has  a  narrow  or  wide  range  of  effects.  For  the  "morbidity 
parameter"  we  specify  whether  the  trauma  is  describable  by  a  single 
parameter  or  by  multiple  parameters  of  physical  damage;  and  for  "product 
involvement"  we  specify  whether  the  mechanism  by  which  an  injury  is 
produced  can  or  cannot  be  described  in  general  terms  for  all  products 
which  produce  the  injury.    If  it  can  be  stated  that  an  injury  of  a 
particular  type  and  severity  can  be  generically  associated  with  a 
product-type  or  a  class  of  products,  then  we  use  the  term  independent 
when  referring  to  product  involvement.    If  it  cannot  be  stated  as  independent, 
then  the  product  involvement  cannot  be  described  generically  at  the 
product-type  or  class  level,  i.e.,  we  lose  the  ability  to  describe  the 
effects  generically.    In  this  case  the  term  dependent  is  used  in  referring 
to  product  involvement. 
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Although  narrow  and  witb  are  c|ual  i  tat  Ivc  modifiers,  it  is  intended  tliat 
"one  or  few"  is  impiietl  when  using  narrow,  and  "several  or-  iii.uiy"  is  iiiij)lied 
when  using  wide.    In  the  context  of  the  analysis  of  Section  C  below, 
these  terms  will  assume  meaning  relative  to  the  problem  under  investigation. 
For  a  specific  problem,  the  analyst  will  know,  or  determine  by  repeated 
application  of  fault-tree  analysis,  empirical  evaluation,  or  testing,  how  many 
is  implied  by  the  modifier  narrow  and  how  wide  the  range  of  effects  will 
be.    The  values  for  these  modifiers  will  determine,  to  a  large  degree, 
the  likelihood  of  using  a  generic  regulation. 

By  attaching  modifiers  to  each  of  the  factors  a  number  of  combinations 
are  created,  each  of  which  has  its  own  characteristics  and  consequences 
as  it  relates  to  countermeasures .    With  four  factors  and  a  choice  of  two 
modifiers  for  each  factor,  sixteen  combinations  are  possible.    Section  B, 
below,  enumerates  these  combinations  and  discusses  the  consequences  of 
each . 

B.      Combinations  of  Principal  Factors 

The  four  factors  and  their  modifiers  are  presented  as  combinations 
in  Table  II -1.    At  the  top  of  the  table  the  four  factors  are  given,  and 
in  the  right-hand  column  a  comment  is  provided  about  the  regulatory  form 
best  suited  for  each  combination.    In  the  table,  let  N  =  narrow,  W  e  wide, 
S  E  single,  M  =  multiple,  I  =  independent,  D  =  dependent,  stand  for  the 
modifiers . 

Of  these  sixteen  combinations,  one  (#  2)  seems  ideally  suited  to  generic 
formulation,  and  three  others  (#  4,  8,  12)  suited  to  generic  formulation, 
if  the  complexity  of  multiple  test  methods  does  not  defeat  the  advantages 
of  generic  control.  Most  of  the  combinations  appear  to  result  in  situations 
which  may  require  product- specific  regulation.    If  this  is  true, 
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Table    II-l:    Array  of  Combinations  of  Principal  Factors 


CONMINT 


(a) 

(b) 

(d) 

 — —  

1 

N 

N 

s 

D 

product  dependency  suggests  product -speci fie 
regulation  (PSR) 

2 

N 

N 

s 

I 

ideally  suited  for  generic  regulation 

3 

N 

N 

M 

D 

product  dependency  and  multiple  parameters 
suggest  PSR 

4 

N 

N 

M 

I 

generic  regulation  may  be  possible  with 
multiple  test  methods 

5 

N 

W 

S 

D 

not  likely  to  occur;  single  parameter 
measure  unlikely 

6 

N 

W 

S 

I 



not  likely  to  occur;  single  parameter 
measure  unlikely 

7 

N 

w 

M 

D 

product  dependency,  wide  severity  and  multiple 
parameters  suggest  PSR 

8 

N 

w 

M 

 1 

I 

generic  regulation  may  be  possible  with 
multiple  test  methods 

9 

W 

N 

S 

D 

not  likely  to  occur;  single  parameter 
measure  unlikely 

10 

W 

N 

S 

I 

not  likely  to  occur;  single  parameter 
measure  unlikely 

11 

w 

N 

M 

D 

product  dependency,  wide  injury  type, 
multiple  parameters  suggest  PSR 

12 

w 

N 

M 

I 

generic  regulation  may  be  possible  with 
multiple  test  methods 

13 

w 

W 

S 

D 

not  likely  to  occur;  single  parameter 
measure  unlikely 

14 

w 

W 

S 

I 

not  likely  to  occur;  single  parameter 
measure  unlikely 

15 

w 

w 

M 

D 

PSR;  all  factors  show  worst  condition 

16 

w 

w 

M 

I 

PSR;  wide  range  of  injury  type  and 
severity,  and  multiple  parameters 

Legend : 


N  s  narrow 
W  =  v'ide 
S  5  single 


M  E  multiple 
I  E  independent 
D  5  dependent 


PSR  E  product -specific  regulation 
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liowever,  for  a  particular  product -hazard  problem  will  depend  on  the 
nature  of  the  injury  type  iind  severity,  anil  the  extent  to  which  a  proposed 
countenueasure  is  tlependent  on  pioduct  characteristics. 

Sections  C  and  D,  which  lollow,  present  a  procedure  ;ind  data  sources 
for  resolving  these  issues  fv  '  a  particular  problem.    They  indicate  also 
which  methods  are  needed  to  develop  information  for  making  decisions  in 
each  phase  of  the  investigation. 

C.      Procedure  for  the  Determination  of  the  Generic  Case 

In  the  analysis  of  product -hazard  regulation  there  are  three  major 
issues  to  address:    the  injury  mechanism,  the  control  of  that  mechanism, 
and  the  test  method.    Figure  II -1  displays  a  procedure  for  analyzing  and 
evaluating  these  issues.     Information  about  countermeasures ,  test  method 
and  the  injury  mechanism  is  also  generated  as  a  result  of  this  analysis. 

Our  approach  is  to  use  the  logic  displayed  in  Figure  II -1  as  a 
basis  for  a  stepwise  procedure  of  evaluations.    A  procedure  follows  in 
which  each  step  includes  comments  concerning  methods  and  data  sources 
appropriate  to  the  operations  of  that  step. 

Procedure : 

STEP  I :    The  first  task  is  to  develop  the  product -hazard  cluster. 

This  development  is  based  on  identifying  a  particular  set  of  products, 

or  product -types,  that  are  directly  associated  with  the  occurrence  of  a  certain 

hazard.    Assigning  products  initially  to  the  cluster  is  based  on  statistical 

evidence  and  a  fault-tree  analysis*  of  suspected  product -types.    The  data 


*The  elements  of  fault-tree  analysis  are  given  in  the  appendix. 
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Produrt-Hnzard 
Cluster 


Product  Coni]ionent 
(Per  product -type) 


Risk- Producing 
Circumstances 


Statistics  of  Injury- 
Population  Data 


(a) 
(b) 
(c) 
(d) 


Single  Test 
Method  Feasible 


Inj ury 
Mechanism 


Injury  i 
Type(s)  r 


I 


Is  Mechanism  Controllable 
With  Single  Countermeasure? 
fNarrow  ,  r  •   •  4. 

^Wide      ^  injury  types 

Narrow 
Wide 

}f  1  „ }    morbidity  parameter  (s) 


{^i'Tjl""  )  range  of  injury  severity 
Multiple^ 


r Dependent 
Independent 


of  product  type 


C#:  5,6,9,10,13,14 
Not  Possible  or 
Not  Likely  to  Occur 


C#:  1,3,7,11,15,16 
Product -Type  Specific 
 Regulation  


Oh  2,4,8,12 
Is  Countermeasure  Testable 
By  Single  Test  Method? 


yes 


cO 

Single  Test 
Method 


no 


C#:  4,8,12 
Multiple  Test 
Methods 


10 


But  Requires  1  Generic  Standard  Regulation  | 

Development 


*The  numbers  referred  to  correspond  to  the  combination  numbers  in  Table  II -1, 


Figure  II -1:    Flow  Chart  of  Analytic  Procedure 
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sources  for  this  step  are  statistical  compilations,  in-depth  reports 
and  product -t>T)e  descriptions.     It  iiiay  occur  that  the  cluster  is  too 
small  for  further  consideration  for  generic  control.     Hiis  decision  is 
left  to  the  analyst. 

STEP  II:    Analyze  the  product  component  and  risk- producing  circum- 
stances (Boxes  2  and  4  of  Figure  II -1).    The  analyst  should  develop  a 
precise  description  of  the  manner  in  which  the  product  component  is 
involved  in  the  hazard.    The  risk  (degree  of  hazard  control)  and  the 
accident  sequence  should  be  described  in  specific  detail.    This  information 
is  obtained  from  descriptions  of  product  components  and  an  engineering  study, 
or  other  evaluation,  of  the  risk-producing  circumstance.    The  use  of  a 
fault-tree  analysis  will  be  of  great  assistance  in  providing  the  needed 
details.    The  analyses  of  this  step  and  Step  III  are  used  in  Step  IV. 
STEP  III:    Develop  from  accident  frequency  data,  population  demographics, 
and  injury  severity  data,  the  range  of  injury  severity  and  descriptors 
of  injury  types.    The  intent  of  this  step  is  to  characterize  the  number 
of  injury  types  by  population  classes  which  are  associated  with  a  product - 
hazard  cluster  and  to  determine  the  morbidity  parameters  associated  with  the 
types  of  injury  (Box  3  of  Figure  II -1). 

STEP  TV:    Use  fault- tree  analysis  to  determine  the  causes  and  contributing 

factors  or  events  in  the  injury-producing  mechanism;  obtain  a  specific 

description  of  injury  type(s)  and  population  affected.    The  results  of 

this  step  should  provide  preliminary  information  about  the  injury  mechanism 

and  what  form  its  control  may  take.    This  step  may  require  a  "boot-strap" 

operation  to  get  started.    The  analyst  should  postulate  the  injury-mechanism 

and  then  refine  its  description  and  character  with  repeated  evaluations  of 

data,  fault -tree  analysis  and  product  attributes. 
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STEP  V:  Ascertain  those  countermeasures  which  can  be  used  to  correct 
the  perceived  product -hazard  problem.  This  determination  is  based  on 
the  evaluation  of  four  conditiqns: 

(1)  the  number  and  character  of  injury  types, 

(2)  the  number  and  character  of  injury  severities, 

(3)  the  number  of  morbidity  parameters  needed  to  characterize  the 
injury  severities, 

(4)  the  relationship  between  the  countermeasures  and  product- type (s) . 
Table  II -1  enumerates  the  possible  combinations  of  these  four  conditions, 
based  on  an  understanding  of  narrow  as  few  and  wide  as  many.  Just  how 
"few"  and  how  "many"  must  be  determined  by  the  analyst.    This  decision 

is  based  on  his  perception  of  the  degree  of  generality  he  is  willing  to 

accept  as  a  basis  for  generic  regulation.    For  an  effective  generic 

standard,  "narrow"  should  be  no  more  than  two,  and  'Vide"  should  be 

greater  than  two.    Otherwise,  either  the  problem  can  be  treated  by 

separating  the  effects  and  analyzing  them  on  that  premise  or  the  problem 

is  not  likely  amenable  to  generic  regulation. 

Box  6  of  Figure  II -1  shows  the  sixteen  combinations  of  Table  II-l. 

A  study  of  Table  II -1  reveals  that  three  groups  emerge,  the  first  with 

generic  possibilities  (Box  7) ,  the  second  with  little  likelihood  of 

occurrence  (Box  8) ,  and  the  third  for  which  a  product -specific  approach 

seems  to  be  more  appropriate  than  a  generic  one  (Box  9) .    The  numbers 

shown  in  Boxes  7,  8,  and  9  refer  to  the  combinations  of  Table  II -1.  It 

should  be  noted  that  for  a  particular  problem  these  conclusions,  as 

represented  by  the  comments  with  Table  II -1  and  the  logic  of  Figure  II-l, 

may  be  different  in  some  degree,  and  such  differences  might  lead  to 

modifications  of  our  general  conclusion  about  these  combinations  and 
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their  generic  properties.    Boxes  8  and  9  are  not  developed  further,  since 
they  show  that  either  the  combination  is  unlikely  or  the  combination 
appears  to  be  better  suited  for,  product -specific  regulation.  Box  7  is 
the  next  step  of  our  analysis  which  addresses  the  resolution  of  issues 
concerning  test  methods. 

STEP  VI :    Determine  whether  a  single  test  method  can  be  specified.    It  is 
necessary  to  use  information  on  the  injury  mechanism,  product  components, 
and  the  number  of  and  differences  among  the  identified  morbidity  parameters 
(ref.  Step  III).    A  suggested  method  for  addressing  these  issues  is  to  use 
the  fault -tree  approach.    When  fully  developed,  it  provides  an  appropriate 
level  of  detail  about  matters  concerning  testing  and  countermeasures . 
As  a  result  of  this  evaluation  we  expect  either  a  generic  standard  to 
emerge  with  a  single  test  method  (C#2)  or  a  generic  standard  with  several 
test  methods  (C#4,  8,  12). 

Step  VI  might  reveal  that  a  test  method  can  be  specified,  but  may  not 
be  readily  available  in  a  current  standard.    The  analyst  should  consider 
developing  the  test  method  for  the  generic  standard  if  it  is  feasible  to 
do  so.    Further,  if  test  requirements  can  be  grouped  into  a  single  set 
of  specifications,  or  if  several  test  methods  can  be  replaced  by  a 
single  test  method,  then  a  single  test  method  should  be  considered. 

We  summarize  in  Table  II-2,  below,  the  data  sources  and  methods 

of  analysis  which  may  be  utilized  in  the  steps  of  an  investigative 

procedure.    To  a  large  degree  the  problem  under  study  will  determine 

which  methods,  data  sources,  etc.,  will  be  used.    Table  II -2  is  only 

intended  as  a  general  guide  and  reminder  for  the  analyst.    The  table 

includes  several  methods  which  are  not  described  in  the  text:  rank-ordering 

by  value,  rank-ordering  by  index,  correlation  analysis,  and  factor  analysis. 
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Tliese  techniques  are  conceptually  difficult  and  require  a  familiarity  with 
advanced  statistical  methods  to  be  used  effectively;  they  also  require 
detailed  data  structures  in  order  to  perform  between- cluster  and  within- 
cluster  analyses.    Their  inclusion  in  Table  II-2  is  for  completeness  and 
to  remind  the  user  of  their  existence  in  the  case  that  fault- tree  analysis 
is  inadequate  but  appropriate  data  sources  are  available.  Professional 
assistance  should  be  obtained  if  these  methods  are  employed. 


T.'ble  II-2:    Suiinary  of  Methods  and  Data  Sources 


D.      Method  of  Analysis 
Introduction 

Sections  A,  B,  C,  above,  describe  the  process  by  which  the  generic 
case  is  identified  and  analyzed.    In  this  section  the  details  of  the 
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analysis  are  developed.    Tliese  details  address  the  classifications  of 
injury,  injury  severity,  products,  :md  hazard.    Tlic  classifications  provide 
the  basis  for  determining  the  commonality  of  the  hazard  ;uTion^  the  product- 
types,  establish  that  product-types  are  correctly  evaluated,  and  determine 
appropriate  countermeasures  and  test-method  characteristics.  Further, 
these  classifications  are  intended  to  be  used  in  conjunction  with  and 
provide  input  to  a  fault- tree  analysis.    The  fault- tree  method  provides 
an  opportunity  for  obtaining  a  number  of  additional  insights  (see  Appendix) 
above  and  beyond  the  primary  objectives  of  identifying  countermeasures 
and  test-methods. 

1.       Injury  Severity  Analysis  and  Classification 
1.1.    Injury  Types 

There  are  three  levels  at  which  injury  types  may  be  organized. 
The  first,  and  most  general,  employs  broad  classification  descriptors  such 
as  toxicity,  shock,  pressure,  bums,  and  mechanical.    Within  this  scheme 
each  of  these  descriptors  may  be  subdivided  into  more  detailed  descriptors 
which  denote  the  sources  of  injury,  such  as  noise  under  the  descriptor, 
pressure. 

The  second  level  uses  medical  descriptors  which  depict  the  injury 
as  a  type  of  diagnosis.    Examples  of  this  classification  are  fracture, 
dislocation,  concussion,  laceration,  hematoma ,  and  so  on.    The  number  of 
such  descriptors  would  be  adapted  to  the  injury  types  associated  with 
the  product -hazard  combinations  under  study.    Presumably,  these  would 
be  very  few  in  number,  but  it  is  important  to  capture  in  the  classi- 
fication plan  any  wide  variation  of  hazard- injury  combinations  which  may 
be  present. 
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'Hie  third  level  combines  the  medical  descriptors  of  the  second 
level  with  descriptors  which  specify  body-pcirts  and  appropriate  characteristics 
of  the  affected  population,  such  as  age ,  sex,  and  env i  roiunent . 

To  determine  whether  the  hazard  is  generic  or  product - spec i f ic ,  the 
third  level  of  injury- type  classification  will  probably  have  to  be  used; 
the  first  or  second  levels  may  not  provide  sufficient  resolution 
to  determine  the  issue  for  or  against  a  generic  approach.    It  is  important 
also  to  have  a  scheme  in  which  accident  data  may  be  organized  to  display 
distributional  characteristics.    If  multivariate  analysis  is  to  be 
done,  particularly  factor  analysis,  then  a  classification  scheme  at  the 
third  level  is  required. 

1.2.    Tabulations  of  Product -Severity  Data 

A  great  deal  can  be  learned  about  product -severity  relationships 
from  tabulations  of  accident  data  when  arrayed  in  particular  ways.    Figures  II- 
and  II-2B  show  dummy  matrices  of  two  possible  organizations  of  data. 


Figure  II-2A:    Severity  Tabulation  Matrix 


Produc t- Type  Code  No. :  XYZ 
Diagnosis:    Thermal  Bum 

Disposition 

Severity  Class 

of  Patient 

A 

B 

C 

D 

E 

1 
1 

i 

-4"  ' 

'  5 
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Figure  II-2B:    Severity  Tabulation  Matrix 


Body  Part 

j                 Product -'lype  Code  No.  :  XYZ 
1                 Diagnosis:    Thermal  Bum 
j                  Population  Group: 

1                     Severity  Class 

A 

B 

C 

D 

E 

1 
2 
3 
4 

c 
J 

i 

1 

These  tabulations  will  show  the  general  relationships  among  variables 


of  interest,  and  can  be  used  to  develop  input  data  for  any  of  the  evaluation 
methods  in  these  guidelines.    A  composite  of  such  tables  provides  a 
picture  of  product  clusters  in  regard  to  diagnosis,  severity  and  body 
part  as  they  relate  to  product- type. 

1.3.    Injury  Severity  and  the  CPSA 

Section  9(c)(1)  of  the  Consumer  Product  Safety  Act  states,  in 
part,  that  prior  to  promulgating  a  consumer  product  safety  rule,  the 
Commission  shall  make  appropriate  findings  for  inclusion  in  such  rule 
with  respect  to-- 

(a)  The  degree  and  nature  of  the  risk  of  injury  the  rule  is  designed 
to  eliminate  or  reduce;  and 

(b)  The  approximate  number  of  consumer  products,  or  types,  or  classes 
thereof,  subject  to  such  rule. 
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It  is  clear  that  these  words  imply  (1)  a  requirement  to  depict  the 
hazard  and  its  countermeasure ,  and  (2)  an  estimate  of  the  impact  of  a 
rule  on  a  class  of  product -types,  or  on  separate  products.    Severity  is 
the  critical  variable  in  the  development  of  a  countermeasure  or  evaluating 
a  rule's  impact.    Consequently,  in  the  identification  and  presentation 
of  severity  data,  characteristics  and  consequences  are  both  central  to 
and  technically  requisite  for  the  development  of  a  standard. 

2.    Product  Characteristics 
Introduction 

We  now  examine  ways  in  which  product  characteristics  can  be 
structured  for  purposes  of  analysis  and  evaluation.    Although  a  standard 
usually  addresses  a  product's  performance,  it  is  important  to  emphasize 
that  all  aspects  of  a  product's  history,  from  design  to  distribution  and 
use,  should  be  considered  when  identifying  hazard  and  determining 
corrective  measures  for  perceived  risks. 

Our  interest  in  products  ranges  over  three  broad  areas:  involvement 
in  the  dynamics  of  the  accident,  safety  requirements,  and  functional 
performance.    Our  evaluation  of  these  areas  is  based  on  "scoring" 
a  product  or  product-type  by  filling  in  a  matrix  of  interacting  factors. 

2.1.    Product  Involvement 

Figure  II -3  is  a  scoring  layout  for  depicting  the  nature  of 
a  product's  involvement  in  an  accident  sequence.    The  information  on 
which  scores  or  groupings  are  made  may  be  derived  from  in-depth  accident 
reports,  special  studies,  interviews,  and  fault- tree  analysis.  Scoring 
product  involvement  may  be  done  either  by  checking  a  characteristic 
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according  to  the  interaction  or  by  assigning  a  number  which  represents 
the  importance  of  the  interaction.    The  "checking"  method  serves  only  to 
alert  the  user  of  a  problem,  whereas  "assigning  a  numlicr"  serves  to 
represent  the  severity  of  a  problem.     It  may  not  be  possible  to  score  a 
product  properly  until  a  fault- tree  study  is  made  or  an  engineering 
evaluation  of  the  interaction  is  performed. 


Figure  II-3:    Product  Involvement  Scoring  Matrix 


Product  Characteristics 

Interaction  Modes 

Consumer  Use 

Environmental 

Normal  !  Abnormal 

Stress 

Normal 

Abnormal 

Design 

Construction 

Materials 

Components 

Performance 

Deterioration 

Total  Score 

The  analyst  should  adapt  the  number  or  detail  of  these  characteristics 
and  the  interaction  modes  as  appropriate.    Whatever  scores  are  used  should 
be  consistent  for  all  three  phases  of  the  product  investigation. 

2.2.    Product  Safety  Requirements 

Figure  II-4  is  a  scoring  matrix  for  evaluating  a  product's 
safety  characteristics.    Each  product  is  graded  with  regard  to  its  safety 
features  for  the  user;  degree  of  compliance  with  safety  standards;  and 
for  the  safety  of  product  components,  where  those  components  may  involve 
a  potential  hazard  if  controls  deteriorate,  are  absent,  or  are  inadequate. 
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Figure  11-4: 

Product  Safety  Scoring  Matrix 

Safety  Features 

Product  Characteristics 

User 

Product  Components 

Compliance 

Design 

Construction 

Strength 

Energy  Source 

Thermal  Conditions 

Noise 

Vibrations 

Edges 

Spacing 

Stability  . 

Surfaces 

Mechanical  Action 

Total  Score 

As  before,  this  scoring  matrix  may  need  to  be  adapted  for  a  specific 
problem;  it  is  assumed  the  analyst  can  make  the  necessary  changes  in  the 
scoring  matrix  to  suit  his  needs. 


2.3.    Product  Functional  Performance 

Figure  II -5  is  a  scoring  matrix  for  evaluating  a  product's 
functional  performance.  Each  product  is  rated  on  its  engineering  and 
physical  properties.    We  wish  to  determine  how  the  product  responds  to 
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conditions  which  may  create  a  hazardous  condition,  an  unsafe  substance, 
or  a  dangerous  energy  potential.    'Ilie  score  should  reflect  the  presence 
of  controls  as  they  appear  in  the  make-up  of  the  product's  configuration. 
As  before,  it  may  be  necessary  to  perform  an  engineering  evaluation  before 
a  score  can  be  assigned. 

Figure  II-5:    Product  Functional  Performance  Scoring  Matrix 
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3.    Classification  of  Hazard 

The  primary  reason  for  classifying  hazards  is  to  distinguish  those 
characteristics  of  the  hazard  which  determine  whether  a  generic  standard 
is  possible.    It  is  essential  to  study  carefully  all  aspects  of  the 
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product -hazard  imd  liazard- injury  phenomena  in  order  to  separate  or 
resolve  hazards  which  appear  to  be  similar.    Tliis  analysis  provides  the 
basis  for  specifying  appropriate  countermeasures.  It  is  equally  essential 
to  identify  the  range  of  variation  a  hazard  may  have  because  it  is 
critical  to  determining  whether  a  condition  is  correctable  by  a  generic 
regulation. 

A  hazard  should  be  classified  according  to  the  maimer  in  which  it  is 
associated  with  the  following: 

1.  type, 

2.  factors  in  Hazard  Creation, 

3.  primary  and  Secondary  Sources  of  Hazard, 

4.  hazard  Manifestations. 
These  are  now  discussed  in  turn. 

Hazard  Type  may  be  described  by  the  following  table*  of  descriptors: 
Table  II-3:    Hazard  Type  Classifiers 


Mechanical 
Cut 

Puncture 
Bruise 
Fracture 
Particle  in  Eye 


Bum 
Electrical 
Thermal,  heat 
Thermal,  cold 
Radiation 
Chemical 


Pressure 
Acceleration 
Crushing,  fluid 
Crushing,  solid 
Pinching 
Noise 
Vibration 


Shock 
Electrical 
Pressure 
Contact 
Physiological 
Trauma 

Cold  Immersion 


Toxicity 
Asphyxiation 
Organic  Damage 
Respiratory  System 
Circulatory  System 
Dermatosis 


Others 
Exhaustion 
Chill 


*Hammer,  W. ,  "Handbook  of  System  and  Product  Safety,"  Prentice -Hall, 
1972,  Chapter  4.  U-IS 


Fault-tree  analysis  is  recommended  for  classifying  factors  that  create 
or  contribute  to  the  hazard.    Ihis  analysis  identifies  liow  the  factors 
involve  the  characteristics  of  the  product,  its  mode  of  use,  and  the 
ability  of  the  user  to  abuse  the  product.    We  specify  these  possibilities 
in  Table  II -4. 

Table  II-4:    Classification  of  Factors  in  Hazard  Creation 
Product  Characteristics    Product  Safety  Control    Product  Performance 


Design 
Construction 
Materials 
Performance 
Durability 
Components 


Materials 


Materials 


Design  5  Construction     Design  5  Construction 


Strength 
Energy  Supply 
Hazard  Type 
Reliability 


Strength 

Convenience  Factors 
Normal  Mode 
Abnormal  Mode 
Deterioration 

The  identification  of  primary  and  secondary  sources  of  hazard  provides 
information  about  the  combination  of  events  and  conditions  which  contribute 
to  the  creation  of  a  hazard.    This  information  is  required  for 
establishing  the  nature  and  scope  of  a  countermeasure  to  the  hazard. 
If  the  countermeasure  is  directed  toward  modifying  hazard  sources  rather 
than  hazard  control,  then  both  the  countermeasure  and  the  test  method 
may  be  product-type  dependent.    The  generic  case  is  lost  if  the  hazard 
sources  are  different  for  each  product- type.    A  better  opportunity  for 
generic  control  is  obtained  if  the  countermeasure  and  test  method  are 
directed  toward  hazard  control. 

Hazard  manifestation  refers  to  the  nature  of  an  accident  and  any  subsequent 

injury,  but  it  may  also  be  important  to  consider  how  it  relates  to  product 

durability,  reliability  and  non-consumer  safety  problems. 
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All  possible  modes,  variations  and  forms  of  the  hazard  should  be 
ascertained.    If  the  hazard  is  capable  of  creating  other  hazards,  or 
displays  itself  in  varying  degrees  of  severity  depending  upon  conditions, 
then  each  manifestation  may  have  to  be  treated  separately.  Countermeasures 
designed  against  the  hazard  source  may  be  totally  different  from 
countermeasures  designed  to  control  the  manifestations  of  the  hazard. 

The  best  method  for  analyzing  these  conditions  appears  to  be 
the  fault -tree  diagram,  supported  by  engineering  evaluations  of  the  product 
in  scenarios  which  cover  appropriate  user-product  modes. 

4.    Method  of  Analysis 

Given  that  the  classifications  of  injury  and  severity,  product 
involvement,  and  hazard  have  been  carried  out,  our  investigation  is  ready 
for  the  next  step:    to  develop  the  product -hazard  combinations  and  assign 
these  combinations  to  groups  or  clusters  according  to  some  criteria. 

Figure  II -6  presents  a  procedural  diagram.  The  formation  of  product- 
hazard  combinations  is  based  on  bringing  together  the  classifications  of 
injury  and  severity  with  product  involvement.    The  specification  of  the 
countermeasure  and  the  characteristics  of  the  test  method  are  developed 
from  the  attributes  of  the  product-hazard  combinations  in  the  cluster. 
The  critical  aspects  of  this  process  are  the  assignment  criteria  and  the 
identification  of  the  countermeasure. 

4.1.    Assignment  Criteria 

The  assignment  of  product- types  to  a  cluster  is  based  on  five 
broad  criteria: 

1.  hazard  characteristics  and  intensity, 

2.  product  component. 
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Figure  II-6:    Generic  Standard  Development 
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3.  physical  injury  mechanism, 

4.  population  affected, 

5.  human  factor  level. 

The  criterion  of  hazard  characteristics  and  intensity  deals  with 
the  injury  type,  severity  and  range  of  physical  effects  associated  with 
the  hazard.    This  criterion  establishes  the  basic  attribute  of  the 
cluster  and  the  product-hazard  combinations.    The  remaining  four  criteria 
determine  the  differences  or  similarities  among  products  and  their 
ultimate  assignment. 

The  second  criterion,  product  component,  determines  the  extent  to 
which  products  have  components  in  common  which  are  associated  either  with 
the  hazard  or  the  process  of  injury.  It  may  be  that  a  given  regulation 
can  be  made  for  a  cluster  of  products  even  if  there  are  differences  in 
their  hazard-associated  components.  This  situation  could  arise  from  a 
safety  problem  which  is  primarily  related  to  performance  or  the  injury 
mechanism  rather  than  product  components.  This  criterion  may  serve  as 
an  independent  test  or  as  a  subsidiary  test  of  the  third  criterion. 

The  mechanism  by  which  the  injury  occurs  is  the  third  criterion,  and 
we  are  concerned  here  with  the  mechanical  aspects  of  product  involvement, 
the  forces  applied,  and  the  dynamics  of  the  user- forces -product  components 
mix.    The  recommended  method  for  evaluating  the  product -hazard  combination 
for  this  criterion  is  fault -tree  analysis,  which  should  provide  the  necessary 
description  of  the  accident  scenario.    We  discuss  below  the  need  to 
evaluate  carefully  any  proposed  countermeasure  against  the  details  of 
the  accident  scenario  and  to  ascertain  the  capability  of  the  countermeasure 
to  control  the  injury  mechanism  of  each  product  in  the  cluster. 
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The  fourth  criterion,  population  affected,  is  intended  to 
distinguish  products,  if  it  is  critical  to  do  so,  on  the  basis  of  the 
age  or  sex,  or  on  some  other  demographic  variables,  of  the  population 
experiencing  the  accident. 

The  fifth  criterion,  human  factor  level,  distinguishes  those  product- 
hazard  combinations  in  which  the  injury  mechanism  is  primarily  caused  by 
an  act  or  motion  of  the  user.    This  criterion  attempts  to  separate  the 
primarily  human  factors  accident  from  the  primarily  mechanically  produced 
accident.    The  appropriate  countermeasure  for  the  former  is  more  difficult 
to  specify  than  the  countermeasure  for  the  latter,  and  is  likely  to 
address  the  interaction  of  the  user  with  the  product.    In  the  latter 
case,  however,  the  countermeasure  assumes  that  human  activity  is  not  a 
significant  contributor  to  the  accident,  and  therefore  addresses  a 
product  component  or  mechanism.    There  is  a  middle  ground  in  which  a 
countermeasure  may  have  to  address  some  aspect  of  human  activity  in  its 
control  of  the  product.    How  these  interactions  affect  the  assignment  of 
a  product  to  a  cluster  depend  on  the  product -hazard  combination  being 
investigated. 

4.2.    Identifying  the  Countermeasure 

At  this  point  in  the  analysis,  product-types  are  assumed  to  be 
assigned  a  cluster,  and  the  cluster  is  characterized  by  the  common 
attributes  of  its  members.    The  next  step  is  to  define  a  single  countermeasure 
for  all  the  products  in  the  cluster  and  determine  that  the  countermeasure  is 
applicable  to  each  product  in  the  cluster. 
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Tlie  countemieasure  will  be  more  effective  if  it  can  address  the 
injury-mechanism  directly.     If  the  injury -mechanism  involves  a  complex 
sequence  of  interactions  and  human  activities,  the  countermeasure  may  be 
limited  to  an  indirect  control  of  the  hazard.     If  this  occurs,  a  deeper 
examination  of  a  fault -tree  analysis  may  be  necessary  to  identify  those 
conditions  for  which  direct  control  can  be  established.    If  this  cannot 
be  easily  done,  it  may  be  necessary  to  use  the  injury-mechanism  criterion 
a  second  time  to  separate  products  in  a  cluster  into  two  groups,  one 
amenable  to  the  specification  of  a  countermeasure  and  the  other  for 
which  control  cannot  be  isolated  and  addressed  by  a  countermeasure. 

When  the  countermeasure  has  been  established,  each  product  should 
be  examined  in  the  light  of  the  countermeasure  to  determine  whether  there 
is  any  condition  or  situation  not  covered  or  addressed  by  the  counter- 
measure,  and  whether  the  statement  of  the  control  is  ambiguous  with  regard 
to  individual  products.    This  process  of  checking  the  injury-mechanism 
of  each  product  against  the  countermeasure,  and  verifying  that  the  product- 
countermeasure  relation  is  correct,  is  a  necessary  fine-tuning  and  should 
be  iterated  until  as  many  products  as  possible  are  adequately  and  effectively 
covered  by  the  final  definition  of  the  countermeasure. 

4.3.    Characterizing  the  Test  Method 

A  test  method  is  usually  a  specified  procedure  which  uses 
test  equipment,  data,  criteria,  and  instructions  to  determine  product 
compliance  to  a  standard.    The  test  method  may  address  safety,  or  some 
aspect  of  product  reliability  and  durability. 

A  test  method  for  a  generic  safety  standard  depends  directly  on  the 
specifications  of  the  countermeasure.    The  countermeasure  must  be  defined 
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in  technical  terms  and  must  specify  all  conditions  to  be  satisfied.  The 
basis  for  a  test  method  is  established  when  the  countermeasure  is  presented 
as  a  technical  requirement.    Since  the  test  method  is  intended  for  a 
large  number  of  product -types,  it  is  likely  that  it  will  have  to  be 
developed  directly  from  the  specifications  of  the  countermeasure;  but  it 
may  also  be  possible  to  customize  a  satisfactory  test  method  by  using 
appropriate  parts  of  existing  standards. 

The  problem  of  multiple  test  methods  arises  for  those  situations  in 
which  the  technical  requirements  of  the  countermeasure  cannot  be  fulfilled 
by  a  single  test  method,  or  one  in  which  the  product- types  are  such  that  a 
test  method  is  needed  for  groups  of  types,  even  though  a  single  countermeasure 
is  in  effect. 

This  latter  situation  may  be  simplified  by  splitting  a  generic  standard 
with  multiple  test  methods  into  separate  standards;  but  this  will  depend 
on  the  relative  efficiencies  of  the  multiple  version  versus  the  single. 
It  is  not  a  requirement  of  a  generic  standard  that  it  must  have  only  one 
test  method;  however,  this  is  the  ideal  case. 
E .  Summary 

□lapter  II  has  developed  the  concepts  given  in  Chapter  I  into  a 
method  of  analysis  which  provides  the  basis  for  developing  a  generic 
safety  standard.    The  salient  points  of  this  method  are  the  classification 
of  the  product  and  injury  data,  the  extensive  use  of  the  fault- tree 
diagram,  and  the  iterative  process  of  evolving  the  specifications  of  the 
countermeasure.    The  essential  portion  of  the  process,  on  which  hangs 
the  success  or  failure  of  the  effort,  is  the  development  of  the  cluster, 
whose  properties  are  those  of  its  members.    The  degree  to  which  these 
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properties  are  different  or  similar  with  regard  to  the  product  and  the 
hazard  determine  whether  a  universal  count ermeasure  and  test  method  can 
be  obtained. 

A  determined  application  of  the  assignment  criteria  and  the  fault- 
tree  analysis  should  provide  a  tool  of  adequate  sophistication  for  most 
problems  of  generic  standards  development,  but  judgment  is  a  necessary 
part  of  making  the  scientific  analysis  work  effectively. 
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CHAPTER  III.    DEVELOPING  TlUl  CEJ^ERIC  STANDAR13 

Introduction 

With  the  results  of  the  investigative  procedure  of  Chapter  II 
in  hand,  we  are  now  ready  to  prepare  the  generic  standard  as  a  formal 
instrument  for  review  and  evaluation.    The  documentation  should  include  an 
exposition  of  the  product  characteristics  to  be  modified,  the  hazard 
to  be  controlled,  the  countermeasures  to  be  imposed,  and  the  manner  in 
which  the  test  method  will  apply. 

A.  Product  Characteristics  Modified  by  Generic  Standard 

All  aspects  of  the  modification  of  the  product  or  product -type  should 
be  clearly  detailed  in  both  qualitative  and  technical  terms.    It  is  important 
to  know  how  the  characteristics  of  any  product  change  so  that  an  evaluation 
can  be  made  concerning  the  impact  on  performance,  efficiency  and  cost 
of  the  modified  product.    The  direct  and  indirect  consequences  of  the  counter- 
measure  should  be  explained,  and  any  assumptions  or  latent  conditions 
clearly  stated. 

B.  Hazard  Characteristics  Controlled  by  Generic  Standard 

All  aspects  of  the  manner  and  degree  in  which  the  countermeasure 
controls  or  modifies  the  hazard  must  be  given.    The  control  should  be 
stated  in  terms  of  appropriate  scenarios  of  use  and  environment,  and  under 
what  conditions  there  are  exceptions  to  all  or  part  of  the  intent  of  the 
control.    The  countermeasure  should  include,  as  appropriate,  all  necessary 
data  or  technical  descriptions  pertinent  to  evaluating  its  effectiveness 
and  understanding  the  way  in  which  it  functions  as  a  control. 
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C.  Countermeasure  and  Test  Methods 

Both  the  countermeasure  and  the  test  method (s)  should  be  supported 
with  pertinent  technical  information  for  their  implementation  and  understanding. 
These  will  include  the  requirements  as  imposed  by  the  CPSA,  any  criteria, 
exceptions,  conditions,  test  materials,  etc.  needed  for  any  part  of  the 
implementation  of  the  generic  standard.    The  test  method  will  be  supported 
by  descriptions  and  procedures  for  use,  and  by  threshold  criteria  for 
safe  product  performance.    Any  needed  equipment  will  be  identified  for 
use,  whether  it  is  in  a  laboratory  test,  or  in  a  test  designed  for  use 
at  the  point  of  fabrication,  after  production,  or  after  retail.  Any 
impact  of  the  control  or  test  method  on  any  aspect  of  the  normal  quality 
control  should  be  evaluated  to  determine  consequences  concerning  performance, 
efficiency  or  cost. 

D.  Form  of  the  Standard 

The  analyst  may  be  able  to  utilize  existing  standards,  or  parts  thereof, 
in  the  development  of  the  form  and  content  of  his  generic  safety  standard. 
Test  methods  or  descriptive  material,  either  technical  or  instructional, 
may  be  borrowed  for  inclusion;  therefore,  the  analyst  should  review  all 
pertinent  and  appropriate  extant  standards  for  sources  of  material  which 
are  directly  applicable  to  the  statement  of  a  new  generic  standard.  The 
analyst  should  keep  in  the  mind  the  three  forms  inclusions  may  take:  the 
standard  may  be  developed  by  selecting  appropriate  sections,  or  other 
materials ,  from  parts  of  other  extant  standards  (eclectic) ;  it  may  be 
adapted  from  an  existing  standard  by  modifying  a  portion  or  portions  of  the 
standard  (adaptive) ;  or  it  may  be  developed  by  abstracting  portions  of 
other  standards  and  evolve  from  their  incorporation  and  synthesis  (synthetic) . 
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E.  Content  of  the  Standard 

The  standard  should  provide  descriptions  of  the  expected  product 
performance;  modifications  of  the  construction  of  the  product;  test 
method  specifications,  use,  criteria,  data,  exceptions,  conclusions,  test 
materials,  and  any  special  conditions;  and  any  additional  features  of 
control  above  and  beyond  the  principal  countermeasure. 

F.  Generic  Standards  and  the  Process  of  Development 

A  number  of  reports  and  books  have  appeared  recently  which  deal  with 
various  aspects  and  problems  of  developing  voluntary,  product -specific 
standards.    The  principal  concerns  are  the  effectiveness  of  the 
traditional  process  to  produce  good  standards,  motivations  for  standards 
development,  and  the  role  that  standards  play  in  commerce. 

These  issues  are  involved  and  complicated.    Standards  which  address 
uniformity,  quality  and  interchangeability  would  be  even  more  complicated 
the  standard  is  generic.    Since  the  generic  safety  standard,  as  perceived 
and  presented  in  these  guidelines,  is  directed  to  the  regulation  of 
hazard,  there  is  greater  likelihood  of  a  successful  development  than  if 
the  effort  addressed  the  much  more  difficult  problems  of  uniformity, 
quality  or  interchangeability.    Addressing  safety  in  a  generic  way  seems 
less  likely  to  change  the  traditional  development  process  than  a  similar 
effort  for  one  of  the  more  complex  aspects  of  product  attributes. 

In  Oiapter  I,  Section  D,  seven  principal  impacts  on  the  traditional 
process  were  listed.    These  will  not  be  repeated  here,  but  the  reader 
should  review  them  as  an  integral  part  of  the  discussion  of  this  section. 
These  seven  suggest  that  the  development  of  a  generic  standard  requires 
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different  approaches  to  data  collection,  to  membership  selection,  to  the 
business  of  trade-offs,  and  to  accommodations  of  the  consensus  process. 
The  form  and  extent  of  the  impact  will  be  determined  to  a  large  degree 
by  the  standard  to  be  developed  and  the  pressures  behind  the  need  for 
the  standard.    All  of  the  procedures  of  surveying  existing  standards, 
field  experience,  hazard  and  injury  information  now  become  dependent  on 
distinctions  among  similarities  and  differences  ol  the  products  to  be 
regulated. 

The  most  difficult  aspects  of  the  process  will  be  determining  the 
proper  membership  and  representation  in  the  committee  for  developing  the 
standard,  and  the  ability  to  achieve  a  consensus  on  the  standard. 
However  difficult  these  tasks  are,  the  generic  safety  standard  should 
have  the  advantage  of  being  easier  to  address  in  context.    It  may  be 
possible  to  evolve  the  standard  from  revisions  of  existing  standards  or 
to  come  to  quick  agreement  on  the  specifications  of  a  generic  test 
method,  or  metiiods.  The  objectives  of  the  standard  must  be  properly 
perceived  by  the  developing  committee,  however,  and  the  committee  must 
evaluate  the  effectiveness  of  the  standard  in  addressing  the  safety  requi 
ments  of  the  products  to  be  covered.  : 
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CHAPTER  IV.     IMPACT  EVALUATION  OF  GENERIC  STANDARD 

Introduction 

The  effectiveness  of  a  safety  standard  is  measured  by  the  efficiency 
of  its  regulation  and  the  degree  to  which  it  achieves  its  principal  objective, 
improved  safety.    Once  a  generic  standard  has  been  promulgated,  however, 
it  may  have  an  immediate  and  long  range  impact  on  the  manufacturer,  the 
public  and  the  market. 

The  following  sections  point  up  some  of  these  major  areas  of  impact 
and  suggest  how  they  might  be  evaluated. 

A.  Technological  Impacts 

An  area  of  positive  influence  is  that  in  which  a  regulation  introduces 
an  improved  technological  process  or  in  some  way  enhances  a  product  line 
in  terms  of  quality  or  performance.    It  is  also  possible  that  patentable 
concepts  are  developed  as  a  result  of  safety  and  performance  regulation. 
The  analyst,  therefore,  should  be  aware  of  these  possibilities  by  reviewing 
the  industry's  response  to  regulation,  studying  the  application  for  patents, 
and  observing  the  technical  integrity  of  new  product  lines.    In  the  absence 
of  other  measures  of  impact  the  influence  on  technology  could  be  an 
important  signal  of  regulatory  influence. 

B.  Cost -Benefit 

The  most  direct  impacts  of  a  regulation  are  the  cost  of  compliance 
and  the  benefit  to  the  consumer.    Conversely,  the  intact  may  also  provide 
benefits  to  the  manufacturer  and  higher  costs  to  the  consumer.    It  follows 
then  that  we  may  have  cost  and  benefits  for  both  the  consumer  and  the  manu- 
facturer.   The  following  table  attempts  to  list  some  of  these  for  both  of  the 
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principal  concerned  parties,     lliey  may  not  all  apply  in  a  particular 

case  but  they  are  potentially  present,  and  are  provided  more  in  the  nature 

of  a  check  list. 


Table  IV- 1:    Cost- Benefit  Array 


Consumer 

Manufacturer  i 

1  Item 

Cost 

Benefit 

Cost 

Benefit  | 

Better  product 
performance 

may  be  higher 
or  no  change 

greater 
efficiency 

product 
modification 

 ^ — , 

more  sales,  ! 
bigger  market  ! 
 \ 

Improved 
safety 

may  be  higher 
or  no  change 

fewer  acci- 
dents ,  lower 
severity 

may  be  higher 
or  no  change 

public  acceptance ,| 
enliances  ■ 
reputation  | 

Teclinological 
improvement 

may  be  higher, 
lower,  or  no 
change 

better  effi- 
ciency and 
performance 

may  be  higher, 
lower  or  no 
change 

new  or  enlarged 
market 

Compliance 

higher  unit 
cost 

safer 
product 

testing  or 

process 

modification 

public  acceptance, 
retain  market 
position 

It  may  occur  that  the  hazards  involve  more  than  just  the  manufacturer, 
i.e.,  improper  installation,  handling,  and  so  on,  in  which  case  the  cost- 
benefit  equation  becomes  more  complex  and  difficult  to  evaluate.    It  is 
preferred  that  the  costs  and  benefits  of  Table  IV- 1  be  expressed  numerically 
in  order  to  obtain  a  measurable  impact  of  a  regulation  on  the  product,  on 
the  manufacturer's  technical  and  financial  position,  and  on  public  reaction 
to  improved  safety  and  performance.    To  develop  an  economic  model  of  these 
costs  and  benefits  is  beyond  the  scope  of  these  guidelines;  the  analyst 
should  engage  experts  in  cost -benefit  analysis  to  evolve  an  appropriate 
model  and  its  attendant  data  input  requirements. 
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C.      Estimate  of  Hazard  or  Injury  Reduction 

Since  the  reason  for  rei^iilation  is  to  provide  a  sjiecific  improvement 
in  the  safety  of  the  products  it  regulates,  :in  estimate  of  its  effectiveness 
is  essential  to  its  evaluation.    The  various  ways  in  which  an  estimate  can 
be  made  fall  into  two  groups:    monitoring  the  population  which  uses  the 
product,  or  conducting  a  technical  evaluation  in  which  the  estimate  is 
based  on  a  simulation. 

The  monitoring  of  the  user  population  can  be  done  by  watching  the 
accident  statistics  for  any  changes  or  shifts  in  product-hazard  relation- 
ships.   Unfortunately,  this  approach  can  be  easily  confused  by  other 
factors  which  may  obscure  or  defeat  observing  particular  changes.  This 
is  the  problem  of  the  signal-to-noise  ratio  in  observing  information. 
A  second  problem  is  the  possible  long  delay  before  an  effect  does  occur, 
in  which  case  monitoring  is  an  expensive  investment  with  uncertain  results. 
A  second  monitoring  technique  is  to  perform  a  "before"  and  "after"  statistical 
experiment,  but  here,  as  above,  the  problems  of  signal-to-noise, 
delayed  effects,  exogenous  variables  changing  the  context  of  the  experiment, 
tend  to  discourage  the  use  of  this  method.    A  third  method  is  to  conduct 
a  study  of  the  movement  of  products  in  use  and  gather  data  on  the  effective- 
ness of  the  regulation  in  the  context  of  actual  scenarios  of  product- 
environment  combinations. 

The  methods  of  technical  evaluation  are  an  engineering  evaluation 
of  the  regulated  products  and  a  fault -tree  analysis  of  the  modified 
products.    The  engineering  evaluation  entails  an  experimental  test  of  the 
countermeasure  and  measuring  the  product's  performance  under  appropriate 
and  rigorous  test  conditions. 
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The  use  o£  a  fault-tree  analysis  as  a  probabilistic  model  may 
provide  a  reasonably  good  estimate  of  effectiveness.    If  probabilities 
or  weights  are  assigned  to  each  condition  contributing  to  an  injury,  then 
an  overall  probability  or  index  of  occurrence  can  be  computed.    If  this 
is  done  on  the  product's  fault-tree  before  and  after  the  regulatory  control, 
the  difference  is  a  measure  of  the  reduction  of  the  hazard.    The  principal 
difficulty  is  obtaining  reliable  estimates  of  probabilities  or  weights 
for  each  process  in  the  fault- tree  scheme. 
D.      Other  Factors  in  Impact  Analysis 

In  addition  to  the  items  of  the  sections  above,  an  evaluation  of 
the  impact  of  a  regulation  should  include  an  examination  of  those  voluntary 
standards  the  regulation  is  displacing;  ascertaining  whether  or  not  the 
scope  of  the  regulation  is  adequate  or  weakened  by  being  overextended; 
evaluating  the  conditional  or  compromising  effects  of  assumptions  or 
special  conditions;  and  determining  whether  the  regulation  places  an 
unwarranted  burden  on  the  process  of  compliance  by  virtue  of  its  technical 
or  qualitative  requirements. 
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ANALYTIC  STRUCllJRl-  FOR  I lAZAI^l)  i:VAJ.UAT ION 

Introduction 

One  of  the  most  effective  teclmiques  for  identifying  and  tracing 
hazard  sources  is  fault- tree  analysis.    In  addition  to  its  main  purpose, 
it  also  contributes  to  the  development  of  count ermeasures  and  estimates 
of  risk  reduction  by  virtue  of  its  structure  and  detail. 

The  material  for  this  section  is  based  on  the  excellent  text  by 
W.  Hammer,^  who  in  turn  acknowledges  his  indebtedness  to  the  basic  work 
on  and  development  of  the  fault -tree  method  by  the  Bell  Telephone  Laboratories 
and  the  Boeing  Company. ^    The  concept  has  been  developed  by  others  into  an 
elaborate  method  of  analysis.    The  full  structure  of  this  method  is  too 
complex  for  the  purposes  of  analyzing  consumer  product  hazards,  so  we 
have  modified  the  concepts  to  the  needs  of  our  evaluations. 
1.      Fault-Tree  Analysis 

The  technique  of  fault-tree  analysis  is  based  on  the  following  steps: 

1.  A  description  of  the  hazard  under  study  is  set  down  in  terms 

of  its  quantitative,  operational  and  qualitative  characteristics. 
If  these  are  incomplete  the  technique  will  aid  in  their  discovery. 

2.  All  factors  which  contribute  directly  or  in  combination  to  the 
occurrence  of  the  hazard  are  reviewed.    This  establishes  an 
initial  list  of  conditions  and  events  needed  for  the  analysis. 


^Hammer,  W. ,  "Handbook  of  System  and  Product  Safety,"  Prentice-Hall,  1972 
(Chapter  9) . 

2 Ibid. ,  page  238. 
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3.  A  "tree"  is  prepared  by  diagramming  contributing  events  and 
conditions  which  show  interrelationships  to  each  other  and  the 
hazard.    The  process  begins  with  the  events  or  conditions  that 
could  directly  cause  the  hazard.    This  is  the  first  level  of 
development.    As  the  technique  traces  back  through  cause  and 
effect  relationships,  events  and  conditions  that  contribute  in 
some  way  to  the  existence  of  the  hazard  are  added  to  the  tree. 
As  these  elements  are  added,  the  first  level  becomes 
configured  with  greater  detail  in  the  form  of  branches  and  nodes, 
taking  on  the  nature  of  a  "tree"  structure. 

4.  The  circumstances  under  which  each  element  appears  in  the  fault- 
tree  are  determined.    Each  portion  of  the  diagram  which  depicts 
a  sequence  capable  of  producing  the  hazard  is  studied  carefully 
to  determine  in  precise  terms  the  nature  of  its  contribution. 

5.  For  each  branch  of  the  tree  which  is  determined  to  contribute 
directly  or  indirectly  to  the  hazard,  suitable  expressions  of 
the  interactions  of  events  and  conditions  are  developed  in 
terms  of  "and"  and  "or"  logic. 

6.  The  probabilities  of  events  and  conditions  are  assigned  to  each 
branch,  if  this  information  is  known.    In  the  evaluation  of  product- 
hazard  combinations  the  probabilities  of  occurrence  may  have  to 

be  replaced  by  a  qualitative,  judgmental  model  of  the  possibilities 
for  certain  events  and  conditions. 

7.  Interactions  are  studied  or  simulated  to  obtain  data  on  the  most 
critical  or  likely  combination  of  events  and  conditions  which  may  occur, 


A- 3 


identifying  single  point  or  factor  contributions,  and  identifying 
all  elements  which,  when  modified,  could  alter  the  character  of  the 
hazard. 

Our  method  is  based  upon  two  qualifying  conditions: 

(1)  No  operation  is  partially  successful;  it  either  fails  or  operates 
properly ,  and 

(2)  Basic  failures  are  not  necessarily  independent  of  each  other. 
If  two  or  more  basic  failures  are  related,  i.e.,  a  subsequent  failure 

or  condition  is  directly  traceable  to  a  prior  failure  or  condition,  then 
the  diagram  of  interactions  should  depict  this  sequence,  even  if  the  model 
becomes  more  conplicated  in  its  description  of  such  dependent  elements. 
2.    Fault-Tree  Logic 


functions  have  to  be  provided  for,  and  this  is  done  through  the  use  of 
conventional  symbols  which  are  combined  to  produce  a  flow-chart  of 
interactions.    The  following  symbols  are  based  on  Hammer. 


In  order  to  develop  a  fault- tree  diagram,  certain  basic,  logical 


Y 


AND  gate.    Output  Y  exists  if  and  only  if  all  of 


X, ,  X^,  X_,  X.  occur  or  exist  simultaneously. 


Y 


OR  gate.    Output  Y  exists  if  and  only  if  any  one  or 


combination  of  X, ,  X^,  X  ,  X.  occurs  or  exists. 
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INHIBIT  gate.    Permits  applying  a  condition  or  a 
restriction.    iTie  input  and  condition  or  restriction 
must  be  satisfied  for  an  output  to  exist. 

Identification  of  a  particular  event.    As  part  of  a 
sequence  it  usually  describes  an  input  or  output. 

An  event,  usually  a  malfunction,  given  in  terms  of  a 
component  of  a  product  or  as  some  combination  of 
conditions. 

An  event  normally  expected  to  occur.    Usually  always 
occurs  unless  affected  by  a  failure  or  condition. 

An  event  not  developed  further  because  of  lack  of 
information  or  of  insufficient  consequence.    Could  be 
used  to  indicate  the  need  for  further  study. 

Indicates  and  stipulates  restrictions.    When  used  with 
an  AND  gate,  the  restriction  must  be  fulfilled  before 
the  event  can  occur.    When  used  with  an  OR  gate,  the 
event  may  not  occur  in  the  presence  of  both  or  all 
inputs  simultaneously.    When  used  with  an  INHIBIT  gate, 
stipulation  is  a  variable  condition. 


A  connecting  symbol  to  another  part  of  the  tree  within  the 
same  major  branch.    Has  the  same  functions,  sequence, 
and  numerical  values. 

A  connecting  symbol  to  another  part  of  the  tree  within 

the  same  major  branch.    Has  the  same  functions  and  sequence, 

i 

but  not  numerical  values. 

With  these  symbols,  any  simple  or  complex  sequence  of  events  or 
conditions  may  be  depicted  and  logically  related.     Its  power  is  limited 
only  by  data  which  may  be  incomplete  or  unreliable,  and  by  interactions 
which  are  not  conceptually  understood  or  amenable  to  symbolic  representations. 
Not  only  does  the  fault -tree  diagram  provide  a  clear  characterization  of  a 
hazard  but  it  also  provides  for  the  identification  of  primary  and  secondary 
factors  or  elements  in  the  failure  sequence,  and  highlights  the  specific 
points  at  which  countermeasures  are  to  be  directed. 
3.    Example  of  Fault-Tree  Diagram 

Assume  for  the  example  that  there  is  a  hypothetical  product 
capable  of  inflicting  a  laceration  in  three  different  ways.    Two  ways 
may  occur  in  normal  use  and  the  third  only  after  the  product  has  been 
damaged.    Let  the  source  of  the  injury  be  from  an  exposed  sharp  edge,  a 
mechanism  capable  of  pinching,  and  from  an  exposed  ragged  edge,  a 
result  of  the  product  having  an  easily  broken  component.    Figure  A-1 
is  a  simplified  fault- tree  diagram  of  the  hazard  and  its  sources.  In 
this  figure  the  OR  gates  are  labeled  as  and  the  AND  gates  as 

A,,  A^,  and  A^.    At  the  top  of  the  diagram  is  the  injury;  the  injury  is 
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 I 
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4 
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/ 
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J  L. 


FRANGIBLE  j 

"AC! 

^lON"  { 

COMPONENT  1 

MATERIAL  | 

COMPONENT  1 

11 

/  POOR^  ~  X 

material^, 
\  strength] 


^^IGN - 

icONSTRUC- 
\  TION  / 


10 


>F. 


Figure  A-1:    Example,  fault -tree  diagram 

nOTE:    F-j^  is  a  force  level  beyond  which  a  breakage  occurs  and  '^^  is  a 
force  level  to  produce  a  laceration  from  mechanical  pinching.    The  elements 
in  circles  are  indicated  as  possible  sources  of  malfunction. 
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linked  to  the  three  possible  causes  by  an  OR  gate,  O-j^.    Each  cause  is  then 
linked  to  its  sources  and  conditions,    A  study  of  this  example  would 
indicate  that  poor  design  and  use  of  improper  material  or  construction 
contribute  to  two  of  the  hazards.    If,  in  the  third  case,  pinching, 
the  action  component  (element  9  in  the  fault- tree  diagram)  is  functional, 
then  the  countermeasure  would  be  in  the  form  of  a  safety  guard  and  consumer 
information  about  the  risk;  if  the  pinching  is  not  associated  with  the 
product's  legitimate  function,  then  the  countermeasure  should  address 
the  design  or  construction  of  the  product.    The  circled  elements  in  the 
diagram  specify  elements  which  represent  malfunctions.    These  interactions 
may  require  engineering  evaluations  in  order  to  depict  them  in  the 
fault-tree  diagram.     In  such  cases  the  fault-tree  analysis  will  have  to 
wait  on  this  information  before  it  can  be  completed;  it  has  provided, 
however,  a  definite  benefit  in  that  the  diagram  exposed  the  need  for  an 
engineering  evaluation, 

4.    Benefits  of  Fault-Tree  Analysis 

In  addition  to  its  power  as  a  descriptive  tool  for  product-hazard 
interactions  and  depicting  product  characteristics,  fault-tree  analysis 
may  provide  insight  into  the  comparison  of  products,  energy  efficiency, 
and  information  needed  by  the  public  on  product  performance. 

As  a  tool  for  the  development  of  generic  safety  standards,  the 
method  provides  a  basis  for  a  comparative  analysis  of  product -types  if 
weights  or  probabilities  can  be  assigned  to  the  interactions  depicted  by 
the  fault-tree  diagram. 
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One  of  the  principal  assets  of  fault- tree  analysis  is  its  exposure 
of  how  well  the  product -hazard  or  product-event  interactions  are  understood, 
described  and  quantified.    If  the  method  does  properly  portray  the  actual 
interactions  and  conditions,  discrepancies  or  inconsistencies  will  be  apparent 
in  the  course  of  the  evaluation  of  the  countermeasure  and  test-method. 
These  exposures  may  be  of  the  sort  that  can  be  resolved  only  if  an  engineering 
evaluation  of  the  problem  is  conducted,  and  therefore  the  fault -tree 
analysis  will  serve  to  signify  these  points  of  ambiguity  or  misrepresentation. 
The  areas  in  which  fault- tree  analysis  provides  insight  and 


guidance  are: 

1 

J.  • 

2. 

exposure  and  human  factors, 

3. 

countermeasures , 

4. 

probabilities  or  weighted  effects, 

5. 

engineering  evaluations , 

6. 

product  characteristics, 

7. 

analysis  of  energy  use, 

8. 

comparison  of  products  or  performance, 

9. 

design  changes. 

10. 

consumer  information, 

11. 

test  method  characteristics. 
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